CVE-2026-24013

Critical · CVSS 9.1

Apache IoTDB — Authentication Bypass by Spoofing (CWE-290) via forged sessionId in Thrift RPC

CVSS: 9.1; nvd
EPSS: 0.41%; 33th pct
KEV: No
Class: other; CWE-290

Description

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Search profile — drives PoC discovery

Symbols sessionIdopenSessionIClientRPCServiceTSFetchResultsReqTSExecuteStatementReqcheckLoginTSIServiceThrift RPCTSServiceImplgetSessionIdFromRequestContext

Keywords CVE-2026-24013Apache IoTDBsessionId spoofingThrift RPC authentication bypassIoTDB forged sessionIdIoTDB openSession bypassIoTDB time-series unauthorized readIoTDB 1.3.3IoTDB 2.0.8IoTDB sessionId validation

Versions: 1.3.3 <= version < 2.0.8

References

Status: enriched · ingested 2026-07-07T18:00:32.000Z · profiled 2026-07-07T18:30:32.000Z